git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: git log -p unexpected behaviour - security risk?

From
John Szakmeister <john@szakmeister.net>
Date
Apr 30, 2013, 17:58 UTC
Message-ID
<CAEBDL5W-xuNhyL81TBGhriAr2jM7CC3FtLhfcbEfEAf9GjCJAQ@mail.gmail.com>
In-Reply-To
<vpqy5c0oson.fsf@grenoble-inp.fr>

On Tue, Apr 30, 2013 at 1:05 PM, Matthieu Moy <Matthieu.Moy@grenoble-inp.fr> wrote:

Show 11 quoted lines
> Junio C Hamano <gitster@pobox.com> writes:
>
>> By the way, these options are _not_ about "showing merge commits
>> that introduce code", and they do not help your kind of "security".
>> As I repeatedly said, you would need "-p -m" for that.
>
> Actually, while defaulting to --cc may be convenient, it would indeed
> increase the security risk: currently, "git log -p" shows nothing for
> merges, so it's rather clear that _everything_ is omitted. With --cc,
> the user would see a diff, and could hardly guess that not everything is
> shown without reading the doc very carefully.

I don't believe it's that clear. I bet people assume there's nothing to show, and unless you dig in and discover that `-p` doesn't include merges. In git 1.8.2, `git help log` doesn't seem to make any mention of `-p` not showing a diff for merges.

Just to see, I asked several people around here whether they knew `-p` didn't show diffs for merges, and they were all surprised that diffs were being omitted for merge commits.

-John
Previous: Matthieu MoyNext: John Tapsell
Message 15 of 22 in “git log -p unexpected behaviour - security risk?”
  1. John TapsellApr 11, 2013
  2. Tay Ray ChuanApr 11, 2013
  3. Simon RuderichApr 20, 2013
  4. Junio C HamanoApr 21, 2013
  5. John TapsellApr 21, 2013
  6. Jonathan NiederApr 21, 2013
  7. John TapsellApr 21, 2013
  8. Thomas RastApr 21, 2013
  9. Jonathan NiederApr 21, 2013
  10. Junio C HamanoApr 21, 2013
  11. John SzakmeisterApr 30, 2013
  12. Junio C HamanoApr 30, 2013
  13. John SzakmeisterApr 30, 2013
  14. Matthieu MoyApr 30, 2013
  15. John SzakmeisterApr 30, 2013
  16. John TapsellApr 30, 2013
  17. Junio C HamanoApr 30, 2013
  18. John TapsellApr 30, 2013
  19. Junio C HamanoApr 30, 2013
  20. John TapsellMay 1, 2013
  21. shawn wilsonApr 30, 2013
  22. Junio C HamanoApr 21, 2013

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.